Module oidc 

The OpenID Connect half of the proof check: an issuer’s discovery document, its key set, and the claims the named account’s bot.did.credential identities say must match.

Every fetch here goes to a URL the token names, so each one is resolved and pinned through didbot_http::pinned_client.

Structs

JwksCache

The key sets of the issuers this server has read, each for ten minutes (JWKS_TTL).

Constants

DEFAULT_OIDC_FRESHNESS

How old an OpenID Connect token’s iat may be, absent configuration.

JWKS_ISSUERS 🔒

How many issuers’ key sets are held at once. Past it the set fetched longest ago makes room: an issuer a hosted account named is one of a handful, not thousands.

JWKS_TTL 🔒

How long a fetched JWKS is reused before it is fetched again.

Functions

acceptable_issuer 🔒

Whether issuer is one this server will fetch keys from: on the deployment’s list when it has one, over HTTPS — or plain HTTP on this host where a development stack allows it.

claims_match 🔒

Whether claims, an ID token’s payload, carries every claim identity names, with its value. Each is found by its Claim::pointer: a name beginning with / is a JSON pointer (RFC 6901) into the claims, for a platform that nests them (/kubernetes.io/namespace), and any other name is a top-level claim.

issuer_client 🔒

The client a fetch of url goes through: its host resolved once, refused at a private address, pinned to what it resolved to so the connection cannot land elsewhere, and following no redirect, which would land it elsewhere all the same.

jwks_client 🔒

The client the issuer’s key set is fetched through. Discovery may put the keys on another host — Google’s sit on www.googleapis.com — so that host is checked and pinned the way the issuer’s was. The URL keeps the issuer’s scheme and carries no credentials: https://issuer@host/ is a fetch from host, whatever it begins with.

prove_by_oidc 🔒

Verifies an OpenID Connect ID token against its issuer’s keys, and against the identities of did, the account the request named. One of that account’s identities at the token’s issuer matching is enough.